[v24.x backport] buffer: fix Blob.stream() leaking source buffer - #64664

Open

gabrielbryk wants to merge 241 commits into

nodejs:v24.x-stagingfrom

gabrielbryk:backport-63577-to-v24.x

Commits on Jun 25, 2026

crypto: optimize normalizeAlgorithm dispatch hot path

panva
authored and
aduh95
committed
lib: optimize webidl conversion options

panva
authored and
aduh95
committed
doc: mark stream.compose stable

mcollina
authored and
aduh95
committed
gyp: update deps gypfiles

nadalaba
authored and
aduh95
committed
doc: move hyperlinks outside of text blocks

avivkeller
authored and
aduh95
committed
doc,lib: align WebCrypto names with spec

panva
authored and
aduh95
committed
test: cover webcrypto prototype pollution systematically

panva
authored and
aduh95
committed
build,win: fix VS2022 arm64 PGO build

StefanStojanovic
authored and
aduh95
committed
src: fix crash when reading length on Storage.prototype

3zrv
authored and
aduh95
committed
dns: coerce -0 to +0 in lookup and resolver inputs

panva
authored and
aduh95
committed
fs: coerce -0 to +0 in mode flags and watch intervals

panva
authored and
aduh95
committed
net: coerce -0 to +0 in BlockList prefixes

panva
authored and
aduh95
committed
zlib: coerce -0 to +0 for crc32 seeds

panva
authored and
aduh95
committed
src: add Latin1 fast path in StringBytes::Encode utf8

mertcanaltin
authored and
aduh95
committed
crypto: fix warnings in test_node_crypto.cc

MayaLekova
authored and
aduh95
committed
test: update test426-fixtures to 2965987bf4c96afa400c9356c8e620cb340aaee

nodejs-github-bot
authored and
aduh95
committed
deps: update googletest to 8736d2cd5c1dcba41170ed2fddca14021d4916c3

nodejs-github-bot
authored and
aduh95
committed
lib: make `Navigator#language` getter throw on invalid `this`

3zrv
authored and
aduh95
committed
test: add more test cases for pathToFileURL

RafaelGSS
authored and
aduh95
committed
src: fix edge case when deflateInit2() fails with Z_VERSION_ERROR

ndossche
authored and
aduh95
committed
doc: update `blockList` stability status to release candidate

alphaleadership
authored and
aduh95
committed
deps: update amaro to 1.1.10

nodejs-github-bot
authored and
aduh95
committed
doc: add worker_threads history entries

bobu-putheeckal
authored and
aduh95
committed
crypto: deduplicate X509 subject matching logic

tniessen
authored and
aduh95
committed
doc: clarify tty raw mode applies to input processing only

zeeshan56656
authored and
aduh95
committed
fs: ignore deleted dirs in recursive watch scan

trivikr
authored and
aduh95
committed
test: accept SIGILL aborts in async-hooks tests

trivikr
authored and
aduh95
committed
crypto: handle cipher context allocation failures

Herrtian
authored and
aduh95
committed
doc: fix "used to sent" → "used to send" in http2

watilde
authored and
aduh95
committed
tools: fix zlib updater script
aduh95
committed
doc: add webstreams to args for `pipeline` from `stream/promises`

dsanders11
authored and
aduh95
committed
module: use file: URL as sourceURL for type-stripped CommonJS

joyeecheung
authored and
aduh95
committed
doc: fix AES-OCB IV length in SubtleCrypto.supports example

Anshikakalpana
authored and
aduh95
committed
watch: cancel pending restart on shutdown

trivikr
authored and
aduh95
committed
meta: bump step-security/harden-runner from 2.19.0 to 2.19.4

dependabot[bot]
authored and
aduh95
committed
meta: bump actions/stale from 10.2.0 to 10.3.0

dependabot[bot]
authored and
aduh95
committed
tools: bump the eslint group in /tools/eslint with 7 updates

dependabot[bot]
authored and
aduh95
committed
meta: bump codecov/codecov-action from 6.0.0 to 6.0.1

dependabot[bot]
authored and
aduh95
committed
sqlite: fix stack-use-after-scope with function callback

ndossche
authored and
aduh95
committed
meta: bump actions/cache from 5.0.4 to 5.0.5

dependabot[bot]
authored and
aduh95
committed
meta: bump github/codeql-action from 4.35.3 to 4.36.1

dependabot[bot]
authored and
aduh95
committed
src: add cleanup hooks to `node::ObjectWrap`

addaleax
authored and
aduh95
committed
test: add regression test for using `ObjectWrap` in worker

mohd-akram
authored and
aduh95
committed
test: make Brotli 16GB test wait for backpressure

trivikr
authored and
aduh95
committed
doc: update npm supported versions link

parkhojeong
authored and
aduh95
committed
src: use C++14 deprecated attribute for `NODE_DEPRECATED`

addaleax
authored and
aduh95
committed
test_runner: fix watch cwd with isolation none

trivikr
authored and
aduh95
committed
http2: retain header memory in session accounting

mcollina
authored and
aduh95
committed
doc: fix a/an article typos in module, util, and dns

watilde
authored and
aduh95
committed
events: improve `addAbortListener` perf by caching options object

rluvaton
authored and
aduh95
committed
test: update WPT for urlpattern to 2f28df545c

nodejs-github-bot
authored and
aduh95
committed
deps: update zlib to 1.3.2.1-motley-3246f1b

nodejs-github-bot
authored and
aduh95
committed
deps: update sqlite to 3.53.2

nodejs-github-bot
authored and
aduh95
committed
deps: update googletest to 7140cd416cecd7462a8aae488024abeee55598e4

nodejs-github-bot
authored and
aduh95
committed
fs: prevent spurious recursive watch events on prefix siblings

marcopiraccini
authored and
aduh95
committed
stream: check done before backpressure in stream reader

watilde
authored and
aduh95
committed
url: fix URLSearchParams(null) to prudce null= per spec

marcopiraccini
authored and
aduh95
committed
util: remove style caches from styleText slow path

araujogui
authored and
aduh95
committed
test: add coverage outside SEA

watilde
authored and
aduh95
committed
test: validate ERR_INVALID_THIS for scheduler methods

watilde
authored and
aduh95
committed
test: mark SEA tests flaky on linux arm debug

trivikr
authored and
aduh95
committed
tools: align Bash snippets in GHA with `lint-sh` conventions
aduh95
committed
doc: fix typo in packages.md

watilde
authored and
aduh95
committed
doc: fix typo in vm.md

watilde
authored and
aduh95
committed
test_runner: remove unused shuffleArrayWithSeed

watilde
authored and
aduh95
committed
fs: support caller-supplied readFile() buffers

mcollina
authored and
aduh95
committed
deps: add ngtcp2_fmt.c to build configuration (ngtcp2.gyp)

ShenHongFei
authored and
aduh95
committed
lib: add Iterator global to primordials

Renegade334
authored and
aduh95
committed
lib: improve control abstraction coverage in frozen intrinsics

Renegade334
authored and
aduh95
committed
deps: upgrade npm to 11.17.0

npm-cli-bot
authored and
aduh95
committed
net: support TCP_KEEPINTVL and TCP_KEEPCNT in setKeepAlive

guybedford
authored and
aduh95
committed
src: allow tracking children in `MemoryTracker` with weak edges

addaleax
authored and
aduh95
committed
src: do not track weak `BaseObject`s as childrens of `Realm`s

addaleax
authored and
aduh95
committed
test: add tests for 3 methods in utils

watilde
authored and
aduh95
committed

Commits on Jul 22, 2026

crypto: fix unhandled error in Hash._transform

haramj
authored and
aduh95
committed
src: handle empty MaybeLocal in cjs_lexer::Parse

anonrig
authored and
aduh95
committed
util: fix -0 formatting when numericSeparator is enabled

watilde
authored and
aduh95
committed
doc: fix typo in cli.md

watilde
authored and
aduh95
committed
debugger: await initialization after run and restart

trivikr
authored and
aduh95
committed
test: update WPT for urlpattern to 23aac92784

nodejs-github-bot
authored and
aduh95
committed
util: fix scientific notation formatting

watilde
authored and
aduh95
committed
stream: fix dropped first chunk in Utf8Stream buffer mode

watilde
authored and
aduh95
committed
test: update WPT for url to d4598eba09

nodejs-github-bot
authored and
aduh95
committed
stream: only pass the expected number of parameters to callbacks

aduh95
and
mcollina
committed
crypto: make webcrypto aliasKeyFormat directional

panva
authored and
aduh95
committed
sqlite: do not leave database open after failed open

anonrig
authored and
aduh95
committed
doc: fix incorrect test runner mock examples

emmayusufu
authored and
aduh95
committed
doc,crypto: mark argon2 and encap/decap as stable

panva
authored and
aduh95
committed
benchmark: add child_process async path baselines

anonrig
authored and
aduh95
committed
tls: route event listener exceptions through error handlers
aduh95
committed
debugger: defer probe pause handling until startup

trivikr
authored and
aduh95
committed
doc: clarify callback exceptions

mcollina
authored and
aduh95
committed
child_process: serialize advanced IPC messages natively

anonrig
authored and
aduh95
committed
crypto: use EVP_MAC for HMAC on OpenSSL >=3

panva
authored and
aduh95
committed
tools: update the llhttp updater script
aduh95
committed
crypto,tls: do not ignore BN_get_word error

tniessen
authored and
aduh95
committed
deps: update OpenSSL build config to support compression

pimterry
authored and
aduh95
committed
tls: add certificateCompression option

pimterry
authored and
aduh95
committed
inspector: fix inspector.close() documented behavior

legendecas
authored and
aduh95
committed
src: guard OpenSSL compression header include

panva
authored and
aduh95
committed
stream: fix Utf8Stream stall after full write of multi-byte data

watilde
authored and
aduh95
committed
doc: fix typo in util.md

watilde
authored and
aduh95
committed
build: suppress compiler warnings for histogram

richardlau
authored and
aduh95
committed
doc: add aduh95 to last security release steward
aduh95
committed
deps: update acorn to 8.17.0

nodejs-github-bot
authored and
aduh95
committed
child_process: pass spawn options to the binding positionally

anonrig
authored and
aduh95
committed
tools: bump js-yaml from 4.1.1 to 4.2.0 in /tools/eslint

dependabot[bot]
authored and
aduh95
committed
tools: bump js-yaml from 4.1.1 to 4.2.0 in /tools/lint-md

dependabot[bot]
authored and
aduh95
committed
test: mark test-debugger-run-after-quit-restart as flaky on macOS

mcollina
authored and
aduh95
committed
src: omit unconvertible names in cjs_lexer::Parse

anonrig
authored and
aduh95
committed
tools: update sccache to v0.16.0

targos
authored and
aduh95
committed
fs: do not treat EPERM as ENOTEMPTY on Windows

PickBas
authored and
aduh95
committed
test: tolerate duplicate watch change events

trivikr
authored and
aduh95
committed
stream: fix Writable.toWeb() desiredSize for non-object-mode

mcollina
authored and
aduh95
committed
watch: print name of changed file that triggers restart

marcopiraccini
authored and
aduh95
committed
debugger: lazily wait for initial break output

trivikr
authored and
aduh95
committed
doc: add sxa GPG key (ed25519)

sxa
authored and
aduh95
committed
doc: fix keepAliveTimeout default in http.createServer options

jahanzaib-iqbal-dev
authored and
aduh95
committed
test_runner: add timestamp to JUnit reporter testsuites

Han5991
authored and
aduh95
committed
buffer: implement blob.textStream()

KhafraDev
authored and
aduh95
committed
deps: update googletest to 0b1e895ba4226c2fda5ee0178c9b5b1195a741aa

nodejs-github-bot
authored and
aduh95
committed
perf_hooks: add NODE_PERFORMANCE_GC_MINOR_MARK_SWEEP constant

szegedi
authored and
aduh95
committed
stream: proxy first own method in Readable.wrap()

watilde
authored and
aduh95
committed
test: fix flaky test-runner coverage threshold test

trivikr
authored and
aduh95
committed
lib: lazily initialize kEvents and kHandlers maps

araujogui
authored and
aduh95
committed
util: fix OOM in inspect color stack formatting

Ijtihed
authored and
aduh95
committed
test_runner: improve coverage failure diagnostics

trivikr
authored and
aduh95
committed
test: use one-off agent in http consumed timeout test

trivikr
authored and
aduh95
committed
doc: fix callback example import in fs docs

Rawal27
authored and
aduh95
committed
test: mark hr-time WPT flaky on macos15-x64

trivikr
authored and
aduh95
committed
test: fix typo from overriden to overridden

parkhojeong
authored and
aduh95
committed
test: keep finalization close fixture ref alive

trivikr
authored and
aduh95
committed
crypto: fix large DH generator validation

tniessen
authored and
aduh95
committed
tls: handle large RSA exponents in X.509 cert

tniessen
authored and
aduh95
committed
src: avoid redundant call to `std::get_if<>()`

tniessen
authored and
aduh95
committed
deps: c-ares: cherry-pick 8ba37af8e3fb

Renegade334
authored and
aduh95
committed
esm: add `--experimental-import-text` flag

efekrskl
authored and
aduh95
committed
doc: add missing option to man page

richardlau
authored and
aduh95
committed
typings: add typing for crypto

panva
authored and
aduh95
committed
zlib: reject trailing gzip members in web streams

panva
authored and
aduh95
committed
zlib: expose rejectGarbageAfterEnd option

panva
authored and
aduh95
committed
meta: speed up stale bot

avivkeller
authored and
aduh95
committed
doc: update list of people in `SECURITY.md`

richardlau
authored and
aduh95
committed
test: improve lcov reporter snapshot diagnostics

trivikr
authored and
aduh95
committed
test_runner: filter execArgv fallback for child tests

trivikr
authored and
aduh95
committed
doc: update `Http2Server.close` & `Http2SecureServer.close`

samuel871211
authored and
aduh95
committed
test: update WPT for urlpattern to 11a459a2b1

nodejs-github-bot
authored and
aduh95
committed
meta: update status of past strategic initiatives

joyeecheung
authored and
aduh95
committed
src: abstract tracing agent for both legacy and perfetto

legendecas
authored and
aduh95
committed
tools: validate version number in release proposal commit message lint
aduh95
committed
meta: move one or more collaborators to emeritus

nodejs-github-bot
authored and
aduh95
committed
deps: update sqlite to 3.53.3

nodejs-github-bot
authored and
aduh95
committed
deps: update googletest to 8b53336594cc52213c6c2c7a0b29194fa896d039

nodejs-github-bot
authored and
aduh95
committed
doc: add guide and answers to FAQs for first-time contributors

joyeecheung
authored and
aduh95
committed
dgram: skip dns.lookup() for literal IP addresses

BridgeAR
authored and
aduh95
committed
process: fix finalization cleanup ref tracking

trivikr
authored and
aduh95
committed
tls: report negotiated TLS groups

panva
authored and
aduh95
committed
tools: update c-ares updater script
aduh95
committed
build: add manually-dispatched stress-test workflow

joyeecheung
authored and
aduh95
committed
test: make blob desiredSize assertion robust

trivikr
authored and
aduh95
committed
doc: clarify defense-in-depth issues

mcollina
authored and
aduh95
committed
http: fix drain event with cork/uncork

davidje13
authored and
aduh95
committed
benchmark: trim down the argon2 sets

panva
authored and
aduh95
committed
meta: clarify V8 flags are outside threat model

authored and
aduh95
committed
lib: use `__proto__: null` when calling `ObjectDefineProperty`
aduh95
committed
meta: bump github/codeql-action/upload-sarif from 4.36.1 to 4.36.2

dependabot[bot]
authored and
aduh95
committed
meta: bump github/codeql-action/init from 4.36.1 to 4.36.2

dependabot[bot]
authored and
aduh95
committed
meta: bump rtCamp/action-slack-notify from 2.3.3 to 2.4.0

dependabot[bot]
authored and
aduh95
committed
meta: bump codecov/codecov-action from 6.0.1 to 7.0.0

dependabot[bot]
authored and
aduh95
committed
meta: bump github/codeql-action/analyze from 4.36.1 to 4.36.2

dependabot[bot]
authored and
aduh95
committed
meta: bump github/codeql-action/autobuild from 4.36.1 to 4.36.2

dependabot[bot]
authored and
aduh95
committed
meta: bump actions/cache from 5.0.5 to 6.1.0

dependabot[bot]
authored and
aduh95
committed
src: fix escaping of single quotes in task runner
aduh95
committed
doc: fix typo in examples

vassudanagunta
authored and
aduh95
committed
stream: expose ReadableStreamTee

mcollina
authored and
aduh95
committed
doc: recommend node-stress-single-test for flaky tests

trivikr
authored and
aduh95
committed
buffer: add fast api for isUtf8 and isAscii

gurgunday
authored and
aduh95
committed
meta: fix linter warning in `stale.yml`
aduh95
committed
doc: clarify HTTP/1.1 response ordering

mcollina
and
aduh95
committed
doc: add note on visibility of CI failures to new contributor guide

sxa
authored and
aduh95
committed
buffer: remove unreachable overflow check in atob

haramj
authored and
aduh95
committed
lib: reject string "0" in validatePort when allowZero is false

watilde
authored and
aduh95
committed
doc: update Http2SecureServer.on("timeout") default value

samuel871211
authored and
aduh95
committed
inspector: fix crash when writing to closed inspector socket

Yayapapa
authored and
aduh95
committed
zlib: validate flush kind for brotli streams

Ic3b3rg
authored and
aduh95
committed
zlib: validate flush king for all streams

Ic3b3rg
authored and
aduh95
committed
stream: preserve half-open duplexes in async iteration

efekrskl
authored and
aduh95
committed
timers: reuse Timeout objects in setStreamTimeout

mcollina
authored and
aduh95
committed
meta: bump actions/upload-artifact from 7.0.0 to 7.0.1

dependabot[bot]
authored and
aduh95
committed
doc: remove typo comma from man page

vassudanagunta
authored and
aduh95
committed
doc: fix inconsistencies in CJS code snippets
aduh95
committed
test_runner: add `getTestContext()`

MoLow
authored and
aduh95
committed
test_runner: add tags option and tag-name filter

atlowChemi
authored and
aduh95
committed
test_runner: fix hooks test context

MoLow
authored and
aduh95
committed
debugger: disambiguate probe location binding

joyeecheung
authored and
aduh95
committed
test_runner: add parentId to test events with testId

MoLow
authored and
aduh95
committed
debugger: surface inspector failures in probe mode

joyeecheung
authored and
aduh95
committed
debugger,test: deflake resume failure test and add debug logs

joyeecheung
authored and
aduh95
committed
test_runner: fix suite diagnostic chanel end

MoLow
authored and
aduh95
committed
test: deflake test-debugger-probe-timeout

joyeecheung
authored and
aduh95
committed
doc: improve `fs.StatFs` properties descriptions

aymanxdev
authored and
aduh95
committed
test_runner: ignore erased TS lines in coverage

mcollina
authored and
aduh95
committed
http: add httpValidation option to configure header value validation

RajeshKumar11
authored and
aduh95
committed
build: remove duplicated node_use_sqlite and node_use_ffi conditions

legendecas
authored and
aduh95
committed
debugger: add more logs to probe mode

joyeecheung
authored and
aduh95
committed
test_runner: cache `shouldSkipFileCoverage` result per URL

Han5991
authored and
aduh95
committed
test_runner: avoid recompiling coverage globs for every file

Han5991
authored and
aduh95
committed
stream: optimize pipeTo promise handling

mcollina
authored and
aduh95
committed
meta: bump actions/checkout from 6.0.2 to 6.0.3

dependabot[bot]
authored and
aduh95
committed
debugger: add --max-hit option to probe mode

joyeecheung
authored and
aduh95
committed
dgram: add synchronous Socket.prototype.bindSync()

guybedford
authored and
aduh95
committed
dgram: add synchronous Socket connectSync()

guybedford
authored and
aduh95
committed
test,debugger: add test for type stripping in debugger probe mode

joyeecheung
authored and
aduh95
committed
stream: reduce allocations on WHATWG streams hot paths

mcollina
authored and
aduh95
committed
build: support setting an emulator from configure script

tie
authored and
aduh95
committed
http: document and validate options.path when it's in absolute-form

joyeecheung
authored and
aduh95
committed
child_process: fix permission model propagation via NODE_OPTIONS

mcollina
authored and
aduh95
committed
module: enable import support for addons by default

legendecas
authored and
aduh95
committed
tools: bump the eslint group in /tools/eslint with 8 updates

dependabot[bot]
authored and
aduh95
committed
stream: cut per-chunk overhead in WHATWG streams

mcollina
authored and
aduh95
committed
net: early TCP binding via synchronous net.BoundSocket

guybedford
authored and
aduh95
committed
crypto: improve accuracy of SubtleCrypto.supports

panva
authored and
aduh95
committed
crypto: reject invalid raw key imports

panva
authored and
aduh95
committed
crypto: coerce -0 to +0 before native calls

panva
authored and
aduh95
committed
crypto: refactor keyObject.toCryptoKey() and SubtleCrypto.getPublicKey()

panva
authored and
aduh95
committed
test: update WPT for WebCryptoAPI to 03a1476844

nodejs-github-bot
authored and
aduh95
committed
crypto: share WebCrypto method and usage helpers

panva
authored and
aduh95
committed
crypto: support non-byte WebCrypto lengths and cSHAKE

panva
authored and
aduh95
committed
crypto: reject small-order EdDSA points during verify

panva
authored and
aduh95
committed
lib: fix missing lazyDOMException import

panva
authored and
aduh95
committed
deps: V8: cherry-pick 64b36b441179

Dan Carney
authored and
aduh95
committed
perf_hooks: sample delay per event loop iteration

pabloerhard
authored and
aduh95
committed
build: build codecache and snapshot with libnode

legendecas
authored and
aduh95
committed
build: remove redundant intermediate node_aix_shared

legendecas
authored and
aduh95
committed
deps: V8: backport bef0d9c1bc90

joyeecheung
authored and
aduh95
committed
src: do not enable wasm trap handler if there's not enough vmem

joyeecheung
authored and
aduh95
committed
src: rename config file testRunner to test

marco-ippolito
authored and
aduh95
committed
src: add test flag to config file

marco-ippolito
authored and
aduh95
committed
src: allow empty --experimental-config-file

marco-ippolito
authored and
aduh95
committed
buffer: fix Blob.stream() leaking source buffer

semimikoh
authored and
gabrielbryk
committed
src: allow Blob reader setWakeup(undefined) to clear wakeup
gabrielbryk
committed